Firefox, Thunderbird, SeaMonkey Get a Security Overhaul

 
 
By Lisa Vaas  |  Posted 2007-06-01 Email Print this article Print
 
 
 
 
 
 
 

Mozilla releases updates for flaws that could result in system hijacking in its open-source browser, e-mail client and Internet applications suite.

The Mozilla Foundation has released security updates to fix multiple flaws that could result in system hijacking in its open-source Firefox browser, Thunderbird e-mail client and SeaMonkey Internet applications suite. The bugs, deemed critical, are detailed in Mozillas Security Advisory 2007-12. They include multiple vulnerabilities in Mozillas Layout Engine and in its JavaScript engine that can result in memory corruption and lead to system takeover or DoS (denial of service). The function of a layout engine is to handle content such as HTML, XML, image files and applets as well as formatting information including CSS (Cascading Style Sheets) and presentational HTML tags. The layout engine displays the formatted content on-screen, filling in the browsers content area.
Firefox users who dont install the ANI patch are in danger of files being overwritten in an attack, given that the browser lacks a low-privilege mode.Click here to read more.
According to Mozillas advisory, the impacts of the vulnerabilities vary. "Some of these crashes that showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code," the advisory says. Mozilla fixed the Layout Engine bugs in these updates: Firefox Versions 2.0.0.4 and 1.5.0.12; Thunderbird Versions 2.0.0.4 and 1.5.0.12; and SeaMonkey Versions 1.0.9 and 1.1.2. The downloads are available at the advisory site.
Mozilla points out that Thunderbird shares Firefoxs browser engine, which could make it vulnerable if JavaScript is enabled in mail. The Foundation says that this isnt the default setting and strongly urges users not to run JavaScript in mail. "Without further investigation we cannot rule out the possibility that for some of these an attacker might be able to prepare memory for exploitation through some means other than JavaScript, such as large images," Mozilla says. Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.
 
 
 
 
Lisa Vaas is News Editor/Operations for eWEEK.com and also serves as editor of the Database topic center. Since 1995, she has also been a Webcast news show anchorperson and a reporter covering the IT industry. She has focused on customer relationship management technology, IT salaries and careers, effects of the H1-B visa on the technology workforce, wireless technology, security, and, most recently, databases and the technologies that touch upon them. Her articles have appeared in eWEEK's print edition, on eWEEK.com, and in the startup IT magazine PC Connection. Prior to becoming a journalist, Vaas experienced an array of eye-opening careers, including driving a cab in Boston, photographing cranky babies in shopping malls, selling cameras, typography and computer training. She stopped a hair short of finishing an M.A. in English at the University of Massachusetts in Boston. She earned a B.S. in Communications from Emerson College. She runs two open-mic reading series in Boston and currently keeps bees in her home in Mashpee, Mass.
 
 
 
 
 
 
 

Submit a Comment

Loading Comments...
 
Manage your Newsletters: Login   Register My Newsletters























 
 
 
 
 
 
 
 
 
 
 
Rocket Fuel